Security vendors race to own the AI control plane

AI security became the category frontage

The loudest movement was not a single launch. It was the number of vendors recutting their shopfronts around AI, agents and the expanding control plane. On 30 Sep, CrowdStrike added a blog on its collaboration with NVIDIA to enhance security across the AI stack and introduced four product pages tied to Project Quiltworks and AI partner specialisation. On 4 Oct, it added 26 product pages focused on AI and browser security, while its homepage shifted to a competition prompt: build, compete and showcase your AI agent by 20 Oct.

Okta moved the same way from the identity side. On 3 Oct, it unveiled the Blueprint Alliance to enhance security for AI agents, and coverage also described an agent gateway for monitoring AI agent runtime actions. Proofpoint used the week to talk about the agentic workspace, with YouTube content on AI intent, integrity and innovation on 2 Oct, and press on 2 Oct covering both a China-aligned phishing operation targeting US AI policy experts and a collaboration to expand its security portfolio with agentic AI.

The pattern extended across the rest of the field. Fortinet added four product pages related to AI and quantum security on 1 Oct and a blog on adversarial AI, while its free P.A.U.S.E. campaign targeted AI-driven scams in Canada. Arctic Wolf’s 3 Oct changelog moved the storyline from triage to the Aurora Agentic SOC and the concierge experience. Rapid7 launched the Rapid7 Intelligence Platform on 4 Oct and added product and blog pages around Rapid7 Intelligence and AI in security operations. AI is no longer a webinar theme in this market. It is the organising principle for navigation, product naming and demand capture.

Palo Alto pushed Cortex towards observability

Palo Alto Networks made the sharpest category adjacency move. On 4 Oct, it launched 16 product pages for the Cortex Xcor observability platform, added two customer pages and 14 blog pages related to observability and AI, and changed its hero from “Let AI coding do more. With you in control.” to “Ask. Remediate. Optimize.” The subtext also moved from protecting data, governing agents and controlling AI costs to a next-generation, AI-driven observability platform.

That is not a cosmetic edit. In the same window, Palo Alto Networks created five repositories covering terraform-provider-scm, scm-go, scm-ansible, scm-python and terraform-aws-swfw-modules. It also had coverage on 30 Sep and 4 Oct of an AI-native platform acquisition intended to bolster Cortex. The company is widening the surface area from detection and response into automation, infrastructure-as-code and operational telemetry.

The timing matters. Between 1 Oct and 4 Oct, Palo Alto Networks also added SASE and migration content, removed older OT security and blog pages, and had a Prisma Cloud status incident identified for stale asset inventory data. The public face changed fast, the developer surface expanded at the same time, and the status surface showed the operational load that comes with owning more of the stack.

Proof became the demand engine

The fortnight was also heavy with evidence merchandising. On 4 Oct, SentinelOne created a page around its IDC MarketScape leader designation for worldwide modern endpoint security for enterprises. Its website heading changed to “A Leader in Modern Endpoint Security”, while the previous “A Major Player in SIEM” heading was removed. That is a clean repositioning: less breadth claim, more category authority.

Tenable refreshed its customer proof on 5 Oct with logos including Continental, Global Payments AU / NZ, Volpara Health Technologies, Netskope, Stone Pagamentos, TCF Bank, Oath, St. Elizabeth Healthcare, Stupp Corporation, Capgemini, N Brown Group, Travis Perkins, American Eagle Outfitters and World Wide Technology. Okta added Vialto to its customer page on 3 Oct and published case studies for Vialto and Rohde & Schwarz. Fortinet added Prensa Ibérica as a customer on 1 Oct, then its customer wall reflected Prensa Ibérica again on 2 Oct as entel was removed.

The paid channel was equally saturated. On 5 Oct, CrowdStrike had 40 Google creatives running after 38 new creatives were observed, with the earliest first shown on 11 Sep. Okta also had 40 running on 5 Oct after 26 new creatives, and SentinelOne had 40 running after 14 new creatives. On 4 Oct, Palo Alto Networks had 40 running after 33 new creatives. On 3 Oct, Fortinet, Proofpoint, Qualys and Tenable were all at 40 running creatives, while Rapid7 reached 40 running creatives after 23 new creatives first shown from 2 Oct. The market did not just ship pages. It fed the machines.

Reliability was the tax on expansion

The same fortnight showed the operational cost of defending and selling across a wider surface. On 1 Oct, CVE-2026-104286 was published for Fortinet FortiMail versions 8.0.0 through 8.0.1 and 7.6.0 through 7.6.6, with a CVSS score of 9.8 for a critical path traversal vulnerability. On 4 Oct, eight articles detailed a critical FortiMail flaw, identified as CVE-2026-10428, being actively exploited in zero-day attacks and allowing unauthenticated arbitrary file writes.

Qualys had repeated service noise. On 2 Oct, it reported two incidents affecting data processing to the UI for Portal modules on US Platform 3 and US Platform 4. One was resolved after about 2,696 minutes and the other was identified with minor impact. On 5 Oct, Qualys had a critical incident in which users were unable to log in to the UI for about 559 minutes, which was later resolved.

Other status and security events filled out the picture. On 3 Oct, Arctic Wolf identified a major incident where Aurora Protect agent version 3.5 memory protection exclusions were not being applied, and resolved a minor Aurora Endpoint Console parsing incident after about 152 minutes. On 1 Oct, Palo Alto Networks identified a minor Prisma Cloud incident involving stale data in the asset inventory. On 30 Sep, Rapid7 resolved a minor alert and investigation creation delay after about 43 minutes. On 30 Sep, a critical CVE with a CVSS score of 9 was published for AiSOC versions 7.2.0 through 12.0.0, involving command injection in an actions service tied to Real Time Response command string construction.

This is the recurring trade-off in security software. Vendors are racing into AI agents, browser security, observability, SASE, email, identity and cloud posture. Every new control point creates another promise to monitor, patch and explain.